PT-2026-36757 · Mcp-Rtfm · Mcp-Rtfm

Brucejqs · Published 2026-05-04 · Updated 2026-05-04 · CVE-2026-7728

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ryanjoachim mcp-rtfm version 0.1.0

Description A path traversal issue exists in the MCP Interface component. A remote attacker can manipulate the docFile argument within the get doc content(), read doc(), and update doc() functions to access or modify files outside the intended directory.

Recommendations Apply patch e6f0686fc36012f78236e7fed172c81444904b0b to version 0.1.0.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7728

Affected Products

Mcp-Rtfm

References · 9

• 🔥 https://github.com/BruceJqs/public_exp/issues/35 · Exploit
• https://github.com/ryanjoachim/mcp-rtfm/commit/e6f0686fc36012f78236e7fed172c81444904b0b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7728 · Security Note
• https://github.com/ryanjoachim/mcp-rtfm/issues/5 · Note
• https://vuldb.com/submit/807538 · Note
• https://twitter.com/VulmonFeeds/status/2051178353877483642 · Twitter Post
• https://vuldb.com/vuln/360903/cti · Note
• https://github.com/ryanjoachim/mcp-rtfm · Note
• https://vuldb.com/vuln/360903 · Note